CVE-2026-18335: Kirki WordPress Plugin SSRF Vulnerability

CVE-2026-18335 Overview

CVE-2026-18335 is a Blind Server-Side Request Forgery (SSRF) vulnerability in the Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress. The flaw affects all versions up to and including 6.2.0 and is reachable via the kirki_data parameter. Unauthenticated attackers can coerce the vulnerable WordPress server to issue HTTP requests to arbitrary destinations. The requests originate from the web application, allowing attackers to probe internal services, metadata endpoints, and other systems not directly exposed to the internet. The weakness maps to CWE-918: Server-Side Request Forgery.

Critical Impact
Unauthenticated attackers can abuse the WordPress server to send arbitrary outbound requests, exposing internal services and cloud metadata endpoints to query and modification.

Affected Products

Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress
All plugin versions up to and including 6.2.0
WordPress sites that expose the vulnerable kirki_data request path

Discovery Timeline

2026-09-24 - CVE-2026-18335 published to the National Vulnerability Database
2026-09-24 - Last updated in the NVD database

Technical Details for CVE-2026-18335

Vulnerability Analysis

The Kirki plugin accepts a user-controlled value through the kirki_data parameter and uses it to construct a server-side HTTP request. Because the plugin does not validate or restrict the destination of that request, an attacker can supply arbitrary URLs. The server then performs the request on the attacker's behalf. The response is not returned to the attacker directly, which classifies this as a blind SSRF. Even without visible responses, attackers can infer internal network topology using timing differences, side effects, and interactions with attacker-controlled infrastructure. Impact includes probing internal services, interacting with cloud instance metadata APIs, and triggering state-changing requests against unauthenticated internal endpoints.

Root Cause

The root cause is missing destination validation on the kirki_data parameter before the plugin issues an outbound HTTP request. There is no allowlist of permitted hosts, no filter for private IP ranges (RFC 1918, loopback, link-local), and no scheme restriction. This matches the [CWE-918] pattern of trusting user-supplied URLs in server-side fetch logic.

Attack Vector

Exploitation requires network access to the WordPress site and no authentication or user interaction. An unauthenticated attacker submits a crafted request containing a kirki_data value pointing to an internal or cloud-metadata URL. The vulnerable plugin performs the fetch from the WordPress server, giving the attacker a pivot into the internal network perimeter. See the Wordfence Vulnerability Report for additional technical context.

No verified public exploit code is available at the time of publication. The vulnerability mechanism is described in prose above; refer to the WordPress Changeset Update for the committed fix.

Detection Methods for CVE-2026-18335

Indicators of Compromise

Outbound HTTP requests from the WordPress host to internal IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) or loopback addresses.
Server-originated requests to cloud metadata endpoints such as 169.254.169.254.
Access log entries containing the kirki_data parameter with URL-encoded values pointing to non-standard hosts.

Detection Strategies

Inspect web server logs for requests referencing kirki_data with external or internal URL values and correlate with egress traffic from the WordPress server.
Deploy a Web Application Firewall rule to flag requests where the kirki_data parameter contains URL schemes (http://, https://, file://, gopher://).
Monitor DNS resolution and egress proxy logs for unexpected lookups generated by PHP worker processes hosting the Kirki plugin.

Monitoring Recommendations

Alert on any WordPress host initiating outbound connections to RFC 1918, loopback, or cloud metadata addresses.
Baseline normal outbound destinations for public-facing WordPress servers and alert on deviations.
Correlate inbound requests containing kirki_data with subsequent outbound traffic within short time windows.

How to Mitigate CVE-2026-18335

Immediate Actions Required

Update the Kirki plugin to a version later than 6.2.0 that includes the fix referenced in the WordPress Changeset Update.
If no patched version is available in your update channel, disable or remove the Kirki plugin until a fix can be applied.
Restrict outbound network access from the WordPress server to only required destinations.

Patch Information

The fix is published through the WordPress plugin repository. Review the WordPress Changeset Update for the code change and apply the latest Kirki release via the WordPress plugin updater. Verify the installed version is greater than 6.2.0 after update.

Workarounds

Block requests containing the kirki_data parameter at the Web Application Firewall until the plugin is updated.
Deny egress from the WordPress host to internal subnets, loopback, and 169.254.169.254 using host or network firewall rules.
On AWS, enforce Instance Metadata Service Version 2 (IMDSv2) to require session tokens that SSRF payloads cannot easily obtain.

bash

# Example nginx rule to block requests carrying the kirki_data parameter
if ($args ~* "(^|&)kirki_data=") {
    return 403;
}